Privacy policy.

This policy explains what personal information Empower Her Thrive collects, why, and what we do with it. It covers the newsletter, the contact form, the director-readiness scorecard, and booking a call. We only collect what a small coaching practice needs to reply to you and run its services.

Who we are

Empower Her Thrive is a solo leadership coaching practice for women leaders. It is operated by Marerisoft, MB, which is the data controller for the information described here.

If you have a question about your data, or want to exercise any of the rights below, email hello@empowerherthrive.com.

What we collect, and why

We collect information only when you choose to give it, through one of five things.

Newsletter

If you subscribe, we store your email address. Subscription is double opt-in: after you sign up we email you a confirmation link, and nothing is added to the mailing list until you click it. Every newsletter carries a one-click unsubscribe link, and unsubscribing removes you from the list.

Contact form

When you send a message, we store your name, email address, and the message itself, so the coach can read it and reply. Your email is used as the reply address.

Director-readiness scorecard

The scorecard asks for your first name and email address before it begins. We store them from that moment, whether or not you finish, so we can send your results and, where relevant, follow up about coaching. As you go, we note how many of the ten dimensions you have completed, never the answers themselves; when you complete it, we store your answers and your scores alongside your name and email address, so the coach can prepare for a conversation with you.

Booking a call

When you book a call, we store your name, email address, your current role, any notes you add, and the time you chose. To place the call in a calendar and create a video link, your name, email, role and notes go into the calendar entry, which both of us can see (see below). If you chose to attach your scorecard result to the booking, it is stored with the booking and shown to the coach; it is not written into the calendar entry.

Booking waitlist

If no times are open and you leave your name, we store your name and email address so we can tell you when times open again. It is one email, sent the morning after times reopen, and you are not added to the newsletter.

Where you came from

If you reach the site through a link that carries a campaign tag, for example one of the coach’s LinkedIn posts or a newsletter, or you arrive from another website, the site notes that tag and the name of that website. It keeps them in your browser tab until you close it, and when you choose to send one of the forms above, they are stored alongside what you send. They say which link brought you here, never who you are, and they are used only to learn which writing is useful to people. Alongside them the site notes a few facts about the visit itself: the page you arrived on, the page the form was on, how many pages you had opened, whether you were on a phone, a tablet or a computer, and the time zone your browser reports. These too are stored only with a form you choose to send.

Where your data goes

We use a small set of established service providers to run the site and its services. We do not add others without reason.

• Supabase stores newsletter subscriptions, contact messages, scorecard registrations and results, and bookings in a secure database, together with a record of each email the site has sent you: which one, when, and whether it was delivered.
• Resend sends the emails: newsletter confirmations and issues, contact notifications, scorecard results and their one follow-up, booking confirmations, the reminder the day before a call, a short note the morning after it, and waitlist notices. Confirmed subscribers are also held in Resend so the newsletter can be sent.
• Google Calendar receives your name and email as attendee details when you book a call, plus your current role and any notes you added, written into the calendar entry so the coach can prepare. Your scorecard result is not put there. This is what creates the calendar entry and its video meeting link.
• Vercel hosts the website and runs the code that handles the forms.

What we don’t do

• We do not sell or rent your data to anyone.
• We do not use advertising or cross-site tracking.
• The site sets no cookies on a visitor’s device; its only cookie is the sign-in for the coach’s own tools, which a visitor never receives. It does keep a few things in your own browser so the pages work: your scorecard answers and progress, the time zone you picked on the booking page, whether you dismissed a banner, and, for one visit, the campaign tag you arrived with and the few facts about the visit. These stay on your device, with two exceptions: the scorecard sends how far you have got as you go and your answers when you finish (see “Director-readiness scorecard”), and the campaign tag and the facts about the visit travel with a form you choose to send (see “Where you came from”). Clearing your browser data removes them.
• We do not use analytics that can identify you. Vercel Web Analytics counts page visits without cookies, and since September 2026 it also counts a few anonymous actions so we can see where the site is confusing — that a scorecard was started or finished and how far through it people get, that a booking or an enquiry was sent, that an FAQ was opened, that a post was read, that a link to LinkedIn or an email address was pressed, and which campaign link or website a visit arrived from. Those counts record what happened and nothing about who did it: no name, no email, no address, nothing you typed. There is no profile behind them, and no way to work back from a count to a person.
• Forms carry automated anti-spam checks. To rate-limit abuse we store a one-way hash of the sending address or IP, never the address or IP itself, and contact messages keep a hashed IP alongside them. These protect the forms; they are not used to profile you.

Our legal bases

We process your data under the EU General Data Protection Regulation (GDPR) and Lithuania’s Law on Legal Protection of Personal Data, relying on the following legal bases.

• Consent for the newsletter. You opt in, confirm by email, and can withdraw at any time by unsubscribing.
• Legitimate interests for replying to enquiries, handling bookings, sending scorecard results you asked for, running anti-spam checks, and noting which link or website brought a visit. This lets a small practice respond to the people who contact it and keep its forms working, in a way you would reasonably expect.

How long we keep your data

• Newsletter subscribers: if you unsubscribe, we keep a record that you did, so we do not email you again by mistake. Ask us and we will remove it entirely.
• Contact messages, scorecard results, bookings, and waitlist entries: kept as ordinary business records until you ask us to delete them.

You can ask us to delete your data at any time (see your rights, below).

Your rights

Under the GDPR you have the right to:

• ask for a copy of the data we hold about you (access);
• ask us to correct data that is wrong or incomplete (rectification);
• ask us to delete your data (erasure);
• ask us to limit how we use your data while a concern is looked into (restriction);
• receive your data in a portable format (portability);
• object to processing we base on legitimate interests;
• withdraw your consent to marketing at any time.

How to exercise your rights

Email hello@empowerherthrive.com and tell us what you would like. We will respond within one month, and there is no charge for a reasonable request.

International transfers

Our database, and the code that handles the forms, run in London. The European Commission recognises the United Kingdom as protecting personal data to the EU standard, under an adequacy decision renewed in December 2025.

Some of our service providers are US companies and may process data in the United States. Those transfers rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s standard contractual clauses.

Complaints

If you are unhappy with how we handle your data, please tell us first, so we have the chance to put it right. You also have the right to complain to a data protection authority. Ours is Lithuania’s State Data Protection Inspectorate, at vdai.lrv.lt, which takes complaints in Lithuanian. If you live or work in another EU country, you can complain to the authority there instead.

Changes to this policy

If we change how we handle data, we will update this page and the date at the top. We will tell newsletter subscribers by email about significant changes that affect them.